Groestl Distinguishing Attack: A New Rebound Attack of an AES-like Permutation

HAL Id: hal-01668116

https://hal.archives-ouvertes.fr/hal-01668116

Submitted on 19 Dec 2017

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

of an AES-like Permutation

Victor Cauchois, Clément Gomez, Reynald Lercier

To cite this version:

Victor Cauchois, Clément Gomez, Reynald Lercier. Groestl Distinguishing Attack: A New Rebound

Attack of an AES-like Permutation. FSE 2018 - 25th International Conference on Fast Software

Encryption , Mar 2018, Bruges, Belgium. �hal-01668116�

Attack of an AES-like Permutation

Victor Cauchois

, Clément Gomez

and Reynald Lercier

1 DGA MI

, Boîte Postale 7, 35998 Rennes Cedex 9, France.

clement.gomez@m4x.org

2

IRMAR, Université de Rennes 1, Campus de Beaulieu, 35042 Rennes, France.

{victor.cauchois,reynald.lercier}@m4x.org

Abstract.

We consider highly structured truncated differential paths to mount a new rebound attack on Grøstl-512, a hash functions based on two AES-like permutations,

and

, with non-square input and output registers. We explain how such differ- ential paths can be computed using a Mixed-Integer Linear Programming approach.

Together with a SuperSBox description, this allows us to build a rebound attack with a 6-round inbound phase whereas classical rebound attacks have 4-round inbound phases. This yields the first distinguishing attack on a 11-round version of

and

with about 2

computations and a memory complexity of about 2

bytes, to be compared with the 2

computations required by the corresponding generic attack.

Previous best results on this permutation reached 10 rounds with a computational complexity of about 2

operations, to be compared with the 2

computations required by the corresponding generic attack.

Keywords:

Cryptanalysis

Hash function

Rebound attacks

AES-like

Grøstl

1 Introduction

Hash functions are of first importance in cryptography. Producing fixed size outputs from inputs of variable length, they are at the heart of many protocols to ensure integrity or authentication properties in numerous cryptographic applications, from signatures to encryption schemes. To be considered safe, they have to offer many security guarantees, among which protection against preimage, second preimage and collision attacks.

The indifferentiability framework, which became very popular among hash functions designers at the time of the SHA-3 competition, aims at avoiding these attacks. This security notion enables to instantiate cryptographic protocols proved secure in the random oracle model by a hash function. Hash functions that iterate a cryptographic permutation whose internal state is partially modified with the message during an absorbing phase and then partially extracted to build the output of the hash function during a squeezing phase are a large class of functions that can be proved secure in this model. However, their validities rely on the assumed ideal behavior of the permutation.

Distinguishers are algorithms that exhibit a non-randomness behavior of a permutation.

Even when they do not directly weaken permutation-based hash functions, distinguishers break the security proof of the hash function. They are a first step in a cryptanalysis and reduce the confidence in these primitives.

Since Rijndael [DR02] has been chosen as the Advanced Encryption Standard, its

“wide-trail strategy” design has inspired lots of symmetric-key primitives, especially since

new processors have integrated the AES round function and key generation as basic

processor operations. Rebound attacks, introduced in [MRST09], was the cryptanalists’

response to the generalization of AES-like permutations used in hash function designs.

It consists in finding a pair of internal register values in the middle of the permutation whose difference propagations towards the input and output registers follow a truncated differential path. When there exist efficient algorithms that yield such differences, it shows a non-random behavior of the permutation, and as such are distinguishers. A critical point is the choice of the truncated differential path, since the complexity of a rebound attack depends for a large part of it.

SHA-3 Cryptographic Hash Algorithm Competition organized by the National Institute of Standards and Technology (NIST) was the ideal playground to extend, develop and apply these techniques, as many of the candidates are built on top of AES-like permutations.

Techniques as start-from-the-middle, introduced by [MPRS09], or SuperSBox descriptions, due to Daemen and Rijmen [DR06] and used for instance in [GP10, WFWS10, Gil14], are useful ideas to mount efficient rebound attacks. Further improvements due to [NP11]

and [SLW

10] have cleared the way for the most recent variants.

Grøstl [GKM

09] is one of these AES inspired primitives. It has been one of the five finalists of the SHA-3 competition. Even if its mode of operation differs from the sponge construction [BDPVA08] used in Keccak, the function finally standardized by the the U.S. National Institute of Standards and Technology, its design still relies on two internal permutations and it comes with a security proof. Andreeva et al. [AMP10] prove that it is indifferentiable from a random oracle, up to the birthday bound under the assumed ideal behavior of the permutations. Two variants of Grøstl have been proposed by its authors, Grøstl-256 and Grøstl-512.

We focus on Grøstl-512, because its rectangular registers of 8 × 16 bytes make our attack possible on 11 rounds. In full generality, non square AES-like permutations are more vulnerable than square ones to rebound attacks, due to their slower diffusion, here three rounds instead of two rounds to obtain a full active state from a single difference, can be used to reach more rounds. The last rebound attack on Grøstl-512 in date is a work by Jean et al. [JNPP14]. It outlines that the rectangular shape of these permutations enables to extend the regular 9-round path of AES-like permutations to reach 10 rounds, thanks to a clever guess and determine algorithm. It turns out, that due to the dense differential pattern at the middle of the differential path, this 9-round path fully constrains the middle register value. In this paper, we consider instead a new differential path that spans over only half of the middle registers. In return, we obtain a huge number of register values that realize this differential path, and we take advantage of their easy characterization to filter among them these that yield a 11-round differential path.

This distinguisher applies on a reduced version of the two internal permutations, 11 rounds instead of the 14 rounds specified in [GKM

09], and not on Grøstl-512 in its entirety. It is commonly admitted that such results help to evaluate the resistance of the Grøstl hash function, but as such, they do not threaten its security.

Although the presented truncated differential path is specific to Grøstl-512, we believe that the technique that we use to patch up three sets of differential values could be applied to other AES-like structures. Such a structured truncated differential path may be found as a solution to a Mixed-Integer Linear Programming problem (MILP). To the best of our knowledge, only few works make use of a MILP approach to analyze hash function, the first of which is a work by Bouillaguet et al. about the SHA-3 candidate SIMD [BFL11].

Acknowledgments. We wish to thank Henri Gilbert for comments that greatly improved

the paper. We are also grateful to the referees for their constructive input.

Our Contributions

We present sparse and highly structured truncated differential paths for the permutations P

and Q

of Grøstl-512, obtained with Mixed-Integer Linear Programming techniques.

We recast it as a SuperSBox description to mount a variant of the rebound attack with a 6-round inbound phase. This method allows us to obtain the best known complexities, reaching 11 rounds with a surprisingly low complexity of 2

computations while previous results reached 10 rounds with a computational complexity of 2

.

Table 1 summarizes the best known results on the 512-bit version of Grøstl. All these attacks are rebound ones, which mainly differ from the truncated differential path used.

Table 1: Known rebound attacks on Grøstl-512 internal permutations.

Rounds Time Generic attack Memory Reference

7 2

2

2

[SLW

10]

8 2

2

2

[JNPP14]

9 2

2

2

[JNPP14]

10 2

2

2

[JNPP14]

11 2

2

2

This paper (§ 4.2)

Outline of the Document

In Section 2, we present Grøstl-512 by focusing on its underlying permutation P

, detailing some properties of its building blocks. In Section 3, we present the structured truncated differential path that we found. We give a SuperSBox description of it and give some hints about its satisfiability and how it can be obtained. In Section 4, we present a distinguisher which finds a pair of inputs whose difference when propagated through the cryptographic permutation agrees with the truncated differential path. Every technical detail is then explained.

2 Description of Grøstl-512

Two different versions of Grøstl have been submitted to the SHA-3 hash function com- petition, Grøstl-256 which outputs 256-bit digests and Grøstl-512 which outputs 512-bit digests.

They handle messages by dividing them into blocks, using some padding. They update then iteratively an internal state initialized with some IV by computing a compression function f on both a block of message and the internal state as illustrated in Figure 1. Its design follows a wide-pipe construction: the size of the internal state is twice larger than the size of the output of the hash function. In both versions, the compression function is built on top of two AES-like permutations, they differ however in a fundamental way:

Grøstl-256 uses a square matrix representation of its internal state whereas Grøstl-512 uses one with a rectangular matrix representation. We focus in this article on Grøstl-512.

2.1 Grøstl-512 Compression Function and Output Transformation

The compression function of Grøstl-512, f

, is built from two 1024-bit permutations P

and Q

, as illustrated in Figure 2a, according to the following definition,

f

(h, m) = P

(h ⊕ m) ⊕ Q

(m) ⊕ h .

f f f f Ω H (m) IV

m

m

m

m

Figure 1: The Grøstl-512 hash function.

We denote by Trunc

the truncation which returns only the 512 last bits of its input.

The output transformation is simpler than the compression function and, as illustrated in Figure 2b, is defined by

Ω(x) = Trunc

(P

(x) ⊕ x) .

h

m

P

Q

f

(h, m)

(a) The compression function

.

P

x Ω(x)

(b) The output transformation Ω.

Figure 2: Grøstl-512 internal functions.

This compression function has been proved collision and preimage resistant under the assumption that P

and Q

are ideal [FSZ09]. Furthermore, the whole Grøstl-512 construction has been proved to be indifferentiable from a random oracle under this latter assumption and the additional hypotheses that P

and Q

are independent from each other [AMP10].

2.2 Grøstl-512 Internal Permutations Round Transformations

The 1024-bit internal states of the AES-like structures P

and Q

are specified as a 16 × 8 matrix of bytes. These permutations then consist in 14 iterations of the following round permutation,

R := MixBytes ◦ ShiftBytesWide ◦ SubBytes ◦ AddRoundConstant , where

• AddRoundConstant (ARC) adds a constant depending on the round to the internal state;

• SubBytes (SB) substitutes each byte in the matrix representation by its image by the non-linear SBox used in Rijndael. As it applies independently on bytes, we will refer as SB indifferently to consider this transformation on full states or on any partial states. To simplify our analysis, we consider an ideal behavior of this transformation:

∀(δ, δ

) ∈ ( F

)

, |{X ∈ F

| SBox(X) ⊕ SBox(X ⊕ δ) = δ

}| ∈ {0, 2} . (1)

Typical examples are almost perfect nonlinear (APN) functions [Dob99]. Another classical assumption due to the non-linearity of SB will be of great use:

“The image of any set of distinct byte values by SB is uniformly distributed” (2) i.e. for all Y

6= Y

6= · · · 6= Y

∈ F

,

Pr

{SBox(X

) = Y

, . . . , SBox(X

) = Y

} = k ! 2

! . We assume that SB

behaves as its inverse;

• ShiftBytesWide (Sh) cyclically shifts the bytes within a row to the left by a number of positions in the matrix representation. For P

, Rows 1 to 8 are respectively shifted by 0, 1, 2, 3, 4, 5, 6 and 11 positions. For Q

, Rows 1 to 8 are respectively shifted by 1, 3, 5, 11, 0, 2, 4 and 6 positions;

• MixBytes (MB) applies to each column independently. We will refer as MB indifferently to consider this transformation on full states or on a single column.

Bytes are seen as elements of F

. This transformation is built from a MDS matrix with coefficients in F

. This will have a great importance in our analysis, it means that the image of a column with k > 0 non-zero bytes by MB has non-zero bytes in at least 9 − k byte positions. The invert matrix of a MDS matrix being MDS, MB

behaves as its inverse.

Remark 1. The last round of AES-like structures traditionally avoids the MB transforma- tion. To be consistent with rebound attacks literature, we will in this article always consider full rounds: with the MB transformation. A quick look at the truncated differential path that we use will however convince the reader that this change does not come into play in the attack.

3 A Distinguisher for Reduced-Round P ₁₀₂₄ with 11 Rounds

We aim here to prove the non-randomness of a reduced version with 11 rounds of the permutations of Grøstl-512. To achieve this goal, we present a distinguisher, conflicting with a non-random behavior of these permutations. We focus here, arbitrarily, on the permutation P

, but everything can be made similarly for Q

(see Appendix A).

Remark 2. As it will be one fundamental measure of complexity in the remaining of this text, we denote β = 2

. To to ease the presentation, we often use Landau asymptotic approximations O(), applied on powers of β to avoid additional logarithmic terms that typically arise from sorting operations. By a slight abuse of notation, we overload this notation for a fixed β, by assuring the reader that we have checked any “O(β

)” to be smaller than β

.

3.1 Limited-Birthday Distinguishers

Gilbert et al. introduced limited-birthday distinguishers [GP10]. The challenge consists in finding a pair of input values whose difference lies in a predefined subspace and whose images by the permutation have their difference lying in another predefined subspace.

Problem 1. Limited-birthday(P, E

, E

): Given a permutation P and two F

-linear

subspaces E

and E

, find a pair of input values (X, X

) such that X ⊕ X

∈ E

and

P (X) ⊕ P (X

) ∈ E

.

They introduced the best known generic algorithm for solving this problem too, the so-called limited-birthday algorithm. Theorem 1 gives its complexity.

Theorem 1. For a n-bit permutation P , a F

-subspace E

of dimension d

, a F

-subspace E

of dimension d

and d

≤ d

, the computational complexity C of the limited-birthday algorithm solving Limited-birthday(P, E

, E

) satisfies:

log

(C) =

(n − d

)/2 if n < 2d

+ d

, n − d

− d

otherwise.

The optimality of this algorithm has been proven by Iwamoto et al [IPS13].

The non-random behavior that we exhibit in Section 4 is based upon Problem 1. We provide an algorithm which solves an instance of this problem with a lower complexity than the one given by Theorem 1.

Remark 3. Solving instanciations of Problem 1 is not the only existing type of distinguishing attack. For instance, Lamberger et al. [LMR

09], Jean et al. [JNPP13] and Gilbert [Gil14]

consider some other ones.

3.2 A 11-Round Truncated Differential Path over P

Introduced by Knudsen in 1995 [Knu95], truncated differentials consider only whether a byte position is affected by a non-zero differential value or not, where a differential value is the difference between two state values. Plenty of hash function cryptanalysis have been analyzed from this perspective, among which [Pey07, MNPN

09, MPRS09, JF11, JNPS12, JNPP14]. Figure 3 specifies the truncated differential path at the center of our attack: Blue cells denote active bytes, where there might be non-zero differences, and white cells denote non-active bytes where there are zero-differences (see Section 3.3 for an explanation on how we have obtained this path).

For such a truncated description, all transformations besides MB are deterministic.

MB induces probabilistic truncated transitions: a column value δ which is non-zero on u chosen byte positions has an image MB(δ) vanishing in v chosen byte positions with probability β

as long as the MDS property is satisfied, and 0 otherwise.

Pr

chosen byte positions

|δ

is non-zero on

chosen byte positions

=

β

if u + (8 − v) ≥ 9 ,

0 otherwise. (3)

Coding theory ensures that the same behavior applies to MB

.

Most rebound attacks rely on truncated differential paths which are diffusing to full active state in three rounds backward and forward. The sequence of numbers of active bytes is a classical representation of such truncated differential paths. The sequence of the differential path used by the 10-round rebound attack of [JNPP14] is

64 −−→

8 −−→

1 −−→

8 −−→

64 −−→

128 −−→

64 −−→

8 −−→

1 −−→

8 −−→

64 .

Our truncated differential path is very different, especially the sequence of numbers of active bytes outlines how structured our path is (see Figure 3),

104 −−→

53 −−→

34 −−→

34 −−→

34 −−→

34 −−→

34 −−→

34 −−→

34 −−→

53 −−→

104 −−→

128 . A first analysis consists in evaluating the plausibility of such a truncated differential path:

the probability that there exists a pair of inputs such that their difference when propagated

through the permutation rounds agrees with the patterns of the truncated differential path.

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

ARC

SB Sh MB

1 2 3 4

5 6 7 8

9 10 11 12

13 14 15 16

17 18 19 20

21 22 23 24

25 26 27 28

29 30 31 32

33 34 35 36

37 38 39 40

41 42 43 44

R

:

R

:

R

:

R

:

R

:

R

:

R

:

R

:

R

:

R

:

R

:

Outb ound In b ound Outb ound

Figure 3: A 11−round truncated differential path over P

of Grøstl-512.

Starting with β

differences, there exist β

(ordered) pairs of internal state values that have their difference equaling each differential value, i.e. a total number of β

pairs of input values. From Equation (3), applied independently on each column, we can estimate the diffusion probability of the differential path given in Figure 3: β

for the propagation through the Round 1 MB transformation, β

for Rounds 2 to 8 and β

for Round 9. Rounds 10 to 11 are deterministic. By Assumption (2), β

· β

= β

· β

= β

= 2

input pairs shall thus fulfill our 11-round differential path.

From these considerations, we got confident in finding pairs of input values whose differences when propagated through the successive transformations agree with the patterns of the truncated differential path of Figure 3. Such a pair solves the problem Limited- birthday(P

, ∆

, ∆

) where ∆

and ∆

are both F

-subspace of differential values of dimension 104. From Theorem 1, we know that the computational complexity of the generic attack is β

= β

= 2

. Our distinguisher is an algorithm that finds such a pair with a computational complexity lower than β

.

In comparison, we have β

· β

= β

pairs of inputs that satisfy the input differential value of the path used in [JNPP14]. Rounds 1 and 7 propagations have then probability β

, the MB propagation probability of Rounds 2 and 8 is β

and the one of Round 6 is β

. Since the other rounds have a deterministic behavior we have therefore β

· β

= β

= 2

input pairs that fulfill this 10-round truncated differential path.

Note that such an analysis benefits to be made from the middle rounds. Starting at Round 6 of the path given in Figure 3, we have β

· β

= β

pairs of values of internal state that have their difference agreeing with Pattern 21. Propagations for Round 6 to Round 11 through MB or for Round 6 to Round 2 through MB

happen both with probability β

· β

· β

· β

= β

and we retrieve that β

· β

= β

input pairs shall fulfill our 11-round differential path.

This analysis derives from rebound attacks. They share an overall strategy, which splits into two phases. The first step is called inbound phase and consists in finding several pairs of values in the middle of the truncated differential path such that this path is verified for as many rounds as possible in the middle of the path. The second step consists in enumerating these pairs to find one satisfying remaining probabilistic transitions of the truncated differential path in outward directions and is called outbound phase. Our inbound phase involves Rounds 3 to 8 and consists in collecting pairs of full state values whose differences agree with Pattern 8 and when propagated until Round 9 with Pattern 32. Our outbound phase consists in finding one among these pairs which satisfies the two remaining non deterministic transitions: through MB in Round 9 and MB

in Round 2. Each holds with probability β

and simultaneously with probability β

= 1/2

.

3.3 Searching Sparse Truncated Differential Paths

Looking for truncated differential paths well-adapted to rebound attacks is closely related to the problem of finding low-weight differential paths in an AES-like block cipher. Mixed- Integer Linear Programming (MILP) solvers turn out be very efficient to solve such problems [MWGP11]. We explain here how the differential paths needed for the inbound and outbound phases can be found with this approach.

Inbound Rounds

We aim at finding long differential paths that span over a as small as possible number of columns, in the hope that it yields in return many more register values that verify the path.

More precisely, we look for a small number of non-zero columns in the 6 inner inbound

rounds: 7 columns at each round (it is unfeasible to find a solution for 6 columns). Instead

of minimizing the number of active S-Boxes in the support of the differential values as in a block-cipher context, we thus have to minimize the number of active columns.

Precisely, we define 7 × 128 decision Boolean variables x

, each seen as one byte of the 7 registers of the permutation P

restricted to 6 rounds: the input, the 5 internal and the output registers. These variables encode truncated differential paths: the variable x

equal to 0 or 1 depending on whether or not a differential path is active at this byte. As it is now classical, we can write the action of Sh and MB as 6 × 16 linear inequalities between the x

’s of the type

X

x∈P

x + X

x⁰∈P⁰

x

≥ 9 t and ∀ v ∈ P ∪ P

, t ≥ v .

The sets P (resp. P

) are subsets with 8 variables that span the r-th round register (resp.

the r + 1-th round register) and the variables t that indicate whether a column is active or not. We furthermore add 6 inequalities, which state that the sum of the 16 variables t defined by Round r is at most 7. This done, we ask for minimizing the sum of these 6 × 16 variables t.

After few minutes with the gurobi solver [Gur17], we found numerous such paths.

Most of them are trivially linked: any shift by a fixed amount of a differential path yields an equivalent path. Finally, two iterative paths catch our attention, the one that we use (see Figure 3) and a second one defined as follows (that does not seem to be better for our purpose).

Sh MB

Note that in both cases, five columns do not reach the MDS bound and we can easily derive from them sparser paths (see Remark 5 in Section 4.4).

Remark 4. The number of non-zero columns depends directly on Sh. But more obvious choices lead to much worse behaviors, for instance shifting by 0, 1, 2, 3, 4, 5, 6 and 7 (instead of 11) positions yields a reproducible differential pattern on only 5 columns.

Outbound Rounds

We take advantage of this MILP approach for searching low-cost outbound differential characteristic as well. For this task, we define the 128 first variables x

, . . . , x

as being equal to the “inbound” differential pattern that we have selected, we also add that after three rounds the output register must have more than 16 non-active bytes and we trace in new variables c the number of zero bytes x

in the output in each active column by the MB transformation. We ask then for minimizing the sum of these variables c, under the condition than the bytes of a register can not be all equal to one.

The best path that we find is the one of Figure 3. Its output register contains 24 zero bytes, up to a transition probability equal to β

= 1/2

: β

for Round 1 and β

for Round 2. We found another path in this way, but with a slightly smaller probability transition, β

, and 17 zero bytes in the output. We give it below for the sake of completeness.

MB◦Sh MB◦Sh MB◦Sh

3.4 SuperSBox Description

For truncated differential paths, ARC transformations may be ignored as they have no impact on truncated differences. Since Sh transformations only move the difference positions and SB transformations apply independently on bytes, they commute and we may permute the applications of these transformations.

Following [DR06], we now define the two following transformations.

• A non-linear SuperSBox (SSB) transformation which applies independently on columns,

SuperSBox := SubBytes ◦ MixBytes ◦ SubBytes .

We will refer as SuperSBox (SSB) indifferently to consider this transformation on full states or on single columns.

• A linear SuperLinear (SL) transformation,

SuperLinear := ShiftBytesWide ◦ MixBytes ◦ ShiftBytesWide . Our 11-round truncated differential path given in Figure 3 may then be rewritten in a more compact form as in Figure 4.

1

2 3 4 5

6 7 8 9

10 11 12 13

14

SL1 SSB1 SL2

SSB2

SL3 SSB3 SL4

SSB4

SL5 SSB5 Sh

MB SB

Figure 4: The 11-round truncated differential path with a SuperSBox description.

4 The Distinguisher

4.1 Notations

Byte values are seen as elements in B = F

. Column values are seen as elements in

C = B

and for X ∈ C , we denote by X

the i

coordinate of X which is also the i

byte of the column. State values are seen indifferently as elements in S ' B

' C

and

for Y ∈ S, we denote by Y

the byte value in the i

row and the j

column. For now

on, all References 1-14 to (grid) patterns are linked to Figure 4. For i ∈ {1, . . . , 14}, P

denotes the B-linear subspace of differential values which agree with Pattern i (whose non-zero byte positions are included in hatched cell positions of Pattern i) and I

is the set of column index which have active bytes. We denote by δ

the restriction of a differential value δ to the j

column and by extension (P

)

denotes the linear subspace of C which agree with the j

column of Pattern i. We call completion of a partial state value V (typically a column value) a full state value whose restriction to byte positions of V is V . By extension, we call completion of a pair of partial state values defined on the same byte positions (V

, V

) a pair of completions of the V

’s such that their difference in other byte positions than byte positions of the V

’s is zero.

4.2 Sketch of the Algorithm

We give an overview of the distinguishing algorithm here. Detailed explanations are postponed to subsequent sections, exception made for the outbound phase, which is trivial.

Step 1. We construct a basis for ∆

, the 12-dimensional B-vector subspace of elements δ

in S whose non-zero byte positions are included in Pattern 4 and whose images by SL

, δ

, have their non-zero byte positions included in Pattern 5:

∆

= {δ

∈ P

| δ

= SL

(δ

) ∈ P

} . (4) We construct a basis for ∆

= {δ

∈ P

| δ

= SL

(δ

) ∈ P

} and a basis for ∆

= {δ

∈ P

| δ

= SL

(δ

) ∈ P

} too. The use of these basis allows us to enumerate elements in these subspaces with negligible computational and memory complexities. The construction of these basis requires O (1) computational and memory complexities.

Step 2. We choose an arbitrary δ

in ∆

. Column by column, for all columns indexed by I

, we store in lists (C

)

all pairs of column values whose differences are compatible with δ

and whose images by SSB

have differences suitable with Pattern 5. Identically for all columns indexed by I

, we store in lists (C

)

all pairs of column values whose differences are compatible with δ

and whose images by SSB

have differences suitable with Pattern 8. We compute thus for all i in I

, respectively for all j in I

, the lists C

, respectively C

, defined by:

C

= { (X, Y ) ∈ C

| X ⊕ Y = (δ

)

, SSB

(X ) ⊕ SSB

(Y ) ∈ (P

)

} , C

= { (X, Y ) ∈ C

| X ⊕ Y = (δ

)

, SSB

(X ) ⊕ SSB

(Y ) ∈ (P

)

} . The construction of these lists requires O (β

) computations and memory space.

Step 3. From O(β

) elements δ

of ∆

, we compute and store β

pairs of 7-column values in a list E, built from combinations of elements in the lists (C

)

, such that any completion induced by this pair of indexed 7-column values has a difference which is equal to δ

and has the difference of its images by SL

◦SSB

that lies in ∆

. From a similar enumeration in ∆

, in a list F, we store β

pairs of 7-column values built from combinations of elements in the lists (C

)

such that any completion induced by these pairs of indexed 7-column values has a difference which is equal to δ

and has the difference of its images by SSB

lying in ∆

. This step costs O(β

) computations and the same in memory.

Step 4. We find (e, e ⊕ (δ

)

) in E and (f, f ⊕ (δ

)

) in F such that (f, f ⊕ (δ

)

)

admits completions whose images by SL

do not contradict with (e, e ⊕ (δ

)

). An

arbitrary choice in E ×F yields such completions only with probability β

. However, β

completions are available whenever it does. Such a pair is found in O(β

) computations

and O (β

) in memory.

Step 5. We determine a pair (s, s ⊕ δ

) of 34-byte values

whose byte positions are induced by Pattern 9 and whose difference is suitable with δ

induced by (f, f ⊕ (δ

)

).

This pair is built in such a way that the image of any completion of these 34-byte values by SSB

has its difference in P

and that there exist β

completions of (f, f ⊕ (δ

)

) whose images by SL

◦ SSB

do not contradict with these 34-byte values. This pair of 34-byte values can be found in O(β

) computations.

Step 6. Among the β

completions found in Step 4 and the β

completions found in Step 5, we compute an intersection of β

completions. Propagated outwards, all these β

pairs of full state values have their differences following the truncated differential path from Pattern 4 to Pattern 10. This has O(β

) computational complexity, requires O(β

) memory space and concludes the inbound phase.

Step 7. By enumerating the β

pairs of full state values collected in Step 6, we find a pair which satisfies simultaneously both remaining independent probabilistic transitions:

through MB from Pattern 10 to Pattern 11 and through MB

from Pattern 4 to Pattern 3. This outbound phase requires O(β

) computations.

To summarize, this algorithm constructs a pair of full state values such that when propagated through 11 rounds of P

, the successive differences agree with the truncated differential path of Figure 4. This is done with O(β

) ' 2

< 2

computational complexity and O(β

) ' 2

< 2

memory complexity. The generic attack on such input and output patterns requires about β

= 2

computations (see Section 3.1).

4.3 Step 1: Construction of the Basis of Linear Subspaces ∆

We explain how to construct a basis of ∆

, the B-vector space defined by Equation (4).

Making explicit the SL

transformation yields Figure 5.

4 4.2 4.3 5

Sh MB Sh

Figure 5: The truncated differential path verified by elements of the set ∆

. From the 34 hatched cells of Pattern 4 , we see that P

is a B-linear subspace of dimension 34. Recalling that MB applies independently on columns, we first focus on the transition of the 9

column of Pattern 4.2 through MB (see Figure 6).

MB

Figure 6: Differential through a MixBytes transformation.

Since MB satisfies the MDS property, the following subspace is of dimension 1:

{ X ∈ C | X

= X

= 0 and (MB(X ))

= . . . = (MB(X))

= 0 } .

By Gaussian elimination, we find {b

}, a basis of this subspace. The same procedure yields {b

}, a basis of the subspace of dimension 1 corresponding to Column 15 and

1By a slight abuse of notation,δ⁰₃ refers here indifferently to differential values that span the whose state or to the restriction to the active bytes.

{b

, b

}, . . . , {b

, b

} basis of the subspaces of dimension 2 corresponding respectively to Columns 10 to 14. We construct then full state values (Y

)

and (Y

)

as completions of (b

)

and (b

)

with 0 bytes in the remaining bytes positions.

A basis of ∆

is then given by

Sh

(Y

), Sh

(Y

), Sh

(Y

), Sh

(Y

), . . . , Sh

(Y

), Sh

(Y

) . Basis for ∆

and ∆

are built in a same way.

4.4 Step 2: Pairs of Columns with Input/Output SuperSBox Differ- ences

Let δ

be an element of ∆

. The purpose of this step is to compute and store the lists C

for all i ∈ I

and the lists C

for all j ∈ I

. Exhaustive search could achieve this goal in 14 · β

computations but we will show now how to do it faster, in the spirit of [SLW

10].

Let us focus on C

, that stores elements in C

whose difference equals (δ

)

and whose images by SSB

have their difference in (P

)

. To this purpose, Figure 7 introduces two intermediate patterns by decomposing SSB

transformation applied on the arbitrarily chosen 8

column.

5 5.2 5.3 6

SB MB SB

Figure 7: A truncated differential through a SuperSBox operation.

We denote by D

the set of differential values agreeing with Pattern 5.3 of Figure 7 and having their image by MB

transformation agreeing with Pattern 5.2,

D

= {δ ∈ (P

)

| MB

(δ) ∈ (P

)

} . From Equation (3), we have |D

| = β. We now denote by D

the set

D

= {δ ∈ C | ∃ X ∈ C s.t. SB

(X ⊕ (δ

)

) ⊕ SB

(X ) = δ} . From Equation (1), |D

| = β

· 2

and

δ ∈ D

⇒

{X ∈ C | SB

(X ⊕ (δ

)

) ⊕ SB

(X ) = δ}

= 2

· β

. By Assumption (2), |D

∩ D

| = 2

· β. The following list has then cardinal β

:

C

= [

δ∈D1∩D2

{(X, X + (δ

)

) ∈ C

| SB

(X ⊕ (δ

)

) ⊕ SB

(X ) = δ} .

To compute C

, we consider all pairs (X, X ⊕ (δ

)

) ∈ C

such that the restriction of

X on the non-active bytes (white cells) is 0. We store, in an intermediate list H , pairs

verifying that the restriction of MB

(SB

(X ⊕ (δ

)

) ⊕ SB

(X)) to the first and

eighth byte positions is 0. We store then in C

, ordered according to the sorting key

δ(X ) = SSB

(X ) ⊕ SSB

(X ⊕ (δ

)

), all elements in C

such that their restriction to

the first, second and eight byte positions equals restriction to those byte positions of some

element in H and such that on the remaining byte positions, the difference is 0. For now

on, when considering elements in C

it could be following the context initial pairs of values

or their images through SSB

.

Remaining lists are computed with the same routine, the computational complexity to construct them correspond to their memory complexity, i.e. the size of the lists: C

, C

, C

, C

, C

, C

, C

are respectively of size β

, β

, β

, β

, β

, β

, β

and C

, C

, C

, C

, C

, C

, C

are respectively of size β

, β

, β

, β

, β

, β

, β

.

Remark 5. We could have considered another truncated differential path, sparser, which is strictly included in the path of Figure 3, replacing Pattern 5 with the following Pattern 5

.

5⁰

We expect this path to be realized by fewer pairs of full state values. The selection of this pattern reduces the dimension of ∆

from 12 to 7. It remains large enough to mount the attack and induces here lists C

and C

of maximum size β

. This step has then O(β

) computational and memory complexities.

4.5 Step 3: Pairs of Partial States Satisfying ∆

to δ

and δ

to ∆

We pick

arbitrary differential values δ

in ∆

. For each δ

in ∆

, we compute its image δ

by SL

. For i in I

, we consider all pairs of columns values in C

computed in Step 2 whose difference through SSB

equals (δ

)

. The computational cost is simply a search in a sorted list. Whenever a match is found simultaneously for each of these seven columns, we store in a list E the pairs of 7-column values computed as the concatenations of all corresponding pairs of columns values in the C

, whose difference is (δ

)

and whose images through SSB

have a difference equal to (δ

)

. We reproduce this routine until we get β

such pairs of 7-column values. This requires to enumerate O(β

) elements in ∆

(see Remark 6). This done, we get the desired list E with β

elements.

A list F of β

pairs of 7-column values whose differences equal δ

and whose images by SSB

have a difference which equals (δ

)

for some δ

in ∆

is built following the same procedure with the lists C

.

Remark 6. By Assumption (1), the map SSB

has the behavior of an ideal SBox applied independently on each column. For a fixed δ

, whenever there exists X in C

such that

SBB

(X ⊕ (δ

)

) ⊕ SBB

(X ) = (δ

)

) ,

which holds with probability 2

, we have 2

elements X with the same property.

Since C

, . . . , C

computed in Step 2 store all possible pairs of column values whose differences equal respectively (δ

)

, . . . , (δ

)

and whose images have a difference lying in P

, we find from the lists C

, with a probability of 2

for an arbitrary element δ

in ∆

, 2

pairs of partial state values, on columns indexed by I

, whose differences equal (δ

)

and images by SSB

have a difference which equals (δ

)

.

4.6 Step 4: First Patching up

We want to find (e, e ⊕ (δ

)

) in E and (f, f ⊕ (δ

)

) in F such that there exists a completion of (f, f ⊕ (δ

)

) whose image by SL

does not contradict with (e, e ⊕ (δ

)

).

We call such a completion a matching completion of (f, f ⊕ (δ

)

) with (e, e ⊕ (δ

)

).

Since δ

= SL

(δ

), we know that any matching completion of f with e is a match- ing completion of f ⊕ (δ

)

with e ⊕ (δ

)

. We show now that for an arbitrary

2We make use of the basis computed at Step 1 for the 12-dimensionalB-vector subspace ∆1.

(e, e ⊕ (δ

)

), (f, f ⊕ (δ

)

)

in E × F , a matching completion exists only with proba- bility β

. We then show how to find such a pair in O(β

) computations and O(β

) in memory.

Figure 8 introduces two intermediate patterns by decomposing the SL

transformation.

Pink cells in Pattern 6.3 correspond to byte values fixed by f whereas green cells in Pattern 6.2 correspond to byte values fixed by e.

6 6.2 6.3 7

Sh MB Sh

Figure 8: Fitting the two pieces, first edition.

MB applies independently on columns, we can therefore analyze local columns transi- tions. Two types of columns have to be distinguished: In columns 7 to 14, there are too many of the c constraints (green cells in Pattern 6.2) to be compensated by the d degrees of freedom (white cells in 6.3). A local matching completion is then possible only with probability β

. In the remaining columns, there are enough of the d degrees of freedom (white cells in Pattern 6.3) to compensate the c constraints (green cells in Pattern 6.2).

We have β

local matching completions for each of these columns.

We do now the exact analysis for the 7

column. Let’s denote by M = {m

} the matrix of MB. Two degrees of freedom are available (byte positions 1 and 8) and three constraints are imposed by fixed values (byte positions 1, 2 and 8). Here, we want to determine given values x

, . . . , x

and y

, y

, y

whether there exist x

and x

verifying Equation (5) or not,

∀` ∈ {1, 2, 8},

7

X

j=2

m

x

+ m

x

+ m

x

= y

. (5) Since M is MDS, the minor m

· m

− m

· m

is non zero, we can then write

x

= l

(x

, . . . , x

) + g

(y

, y

) and x

= l

(x

, . . . , x

) + g

(y

, y

) , where g

, g

, l

and l

are linear forms depending only on MB and on the positions of the fixed bytes. Introducing L

and R

two linear forms obtained by substituting x

and x

by their expressions, Equation (5) is then equivalent to







x

= l

(x

, . . . , x

) + g

(y

, y

) , x

= l

(x

, . . . , x

) + g

(y

, y

) , L

(x

, . . . , x

) = R

(y

, y

, y

) .

A match between e and f is then possible on the 7

column if and only if L

(e

, ..., e

) equals R

(f

, f

, f

). For the sake of simplicity, we drop the byte positions and shall rather write L

(e) and R

(f ).

We find the two linear forms L

and R

by conducting the same analysis for the 13

column. For i ∈ {8, . . . , 12}, we find couple of linear forms L

, L

and R

, R

. We get indeed two pairs of linear forms since the difference between the number of constraints and the degree of freedom is not 1 anymore but 2. We reproduce these arguments for the remaining Columns 1 to 6 and 14 to 16. As there are locally more degrees of freedom than constraints, each choice of (e, e ⊕ (δ

)

), (f, f ⊕ (δ

)

)

in E × F admits local

matching completions. Finally, we have a matching completion of f with e if and only

if the twelve equations L

(e) = R

(f ), L

(e) = R

(f), L

(e) = R

(f ), L

(e) = R

(f ),

. . ., L

(e) = R

(f ), L

(e) = R

(f ) are simultaneously satisfied. Uniformly distributed values fulfill this set of equations with probability β

.

We show now how to find a pair (e, e ⊕ (δ

)

), (f, f ⊕ (δ

)

)

in E × F for which a matching completion of f with e exists in O(β

) computations: We sort the list F according to the lexicographic order given by (R

(f ), R

(f ), R

(f ), R

(f ), . . . , R

(f ), R

(f )) in O(β

) computations and O(β

) in memory. For each element (e, e ⊕ (δ

)

) of E, we compute the value (L

(e), L

(e), L

(e), L

(e), . . . , L

(e), L

(e)) and we check if it belongs to the previous sorted list. This costs O(β

) computations and O(β

) searches in a sorted list. Since β

pairs (e, e ⊕ (δ

)

), (f, f ⊕ (δ

)

)

in E × F are available and since a matching completion of f with e exists with probability β

, we expect to find a match.

No pair admitting a matching completion should happen, we start again from Step 2 with another δ

. For now on, we suppose that such a pair exists. We find it in O(β

) computations and O (β

) in memory.

1 1 1 1 1

2 2 2 2 2 2 3 3 3 3 3 3 3

4 4 4 4 4 4 4

5 5 5 5 5 5 5

6 6 6 6 6 6

7 7

7 8 8 8

8 9 9 9 9

9 MB

6.2 6.3

Figure 9: Fixed bytes and lists of elements.

The pair (e, e ⊕ (δ

)

), (f, f ⊕ (δ

)

)

in E × F being now fixed, all byte values in Columns 7 to 13 of Pattern 6.3 are fixed by this choice (red cells in Figure 9).

We compute now all matching completions of f with e. We construct for each of the nine remaining columns the lists of column values satisfying the linear constraints imposed by fixed bytes. The construction of these lists does not differ from what we just did with the use of linear forms analogous to g

and f

. We have then, as illustrated by Figure 9, B

, B

, B

, B

and B

, lists of β

elements in the 1

, 2

, 3

, 4

and 16

columns, B

and B

, lists of β

elements in the 5

and the 15

columns and B

and B

, lists of β elements in the 6

and 14

columns. We get then β

possible matching completions as direct product of the lists B

(we cannot store this product in a unique list, since this would require outrageous computational and memory complexities).

4.7 Step 5: Second Patching up

At this point of the algorithm, the differential value δ

has been fixed. We have built E, a list of β

pairs of 7-column values indexed by I

such that their difference is (δ

)

and the difference of the images of any completion by SL

◦ SSB

is in ∆

. Similarly, we have built F, a list of β

pairs of 7-column values indexed by I

such that their difference is (δ

)

and the difference of the images of any completion by SSB

is in ∆

. We have found (e, e ⊕ (δ

)

) in E and (f, f ⊕ (δ

)

) in F such that there exist β

matching completions of f with e, whose images by SL

do not contradict with e. Columns e and f are then now fixed. We call δ

∈ ∆

and δ

in ∆

the differential values induced by these choices when propagating (e, e ⊕ (δ

)

) backward by SSB

and (f, f ⊕ (δ

)

) forward by SSB

. We denote by (f

, f

⊕ (δ

)

) the image of (f, f ⊕ (δ

)

) by SSB

.

Each of these β

pairs of full state values, when propagated backward and forward,

have their differences agreeing with Figure 4 from Pattern 4 to 9. To fulfill the whole

truncated differential path, three independent probabilistic transitions remain: through